One-way functions and circuit complexity

It is well known that among the three classes of the PRAM models, namely, CRCW, CREW, and EREW, the CRCW models are the weakest, in the sense that, they permit concurrent read/write by processors. Accordingly, algorithms on the CRCW model mainly concentrate on the core computations without much ado about data access. Consequently, this model, at least in principle, allows for the design of the fastest algorithm for a problem. It is intriguing to ask how fast prefixes can be computed on the CRCW models. Since CRCW models are equivalent to the unbounded fan-in circuits (refer to Chapter 2), the task of developing the fastest algorithms for the prefix problems is pursued in the context of the unbounded fan-in circuits. Recall from Chapter 2, that while the standard measures, such as, size and depth are still used to quantify the goodness of unbounded fanin circuits, the size of the circuit is measured by the total number of edges incident on all of its operation nodes, instead of by the number of operations nodes. It turns out that the size and depth of unbounded fanin circuits for computing prefixes, depends critically on the structure of the underlying semigroup from which the input elements are drawn. The principal result of this concluding Chapter may be stated as follows: There exists unbounded fan-in parallel prefix circuits of constant depth and polynomial size if, and only if, the underlying semigroup is group free. The proof of this result involves a very clever synthesis of a number of ideas drawn from different directions — structure of group free semigroups, their relations to a special class of regular sets, called non-counting regular sets, the relation of this latter class of regular sets to yet another class of regular sets defined by star-free regular expressions, and the design of a special class of finite state deterministic automata called RS machines that accept star-free regular expressions. In this context, it is convenient to define the notion of small circuits as the class of circuits with constant depth and polynomial size.

Based on the results of Blum, Shub and Smale [1], Meer [6], Cucker and Matamala [3] and Koiran [4], we develop the study of real computation models restricted to additive operations. More specifically we introduce some complexity classes defined by algebraic circuits and we study their relationships with the real computation model. We show that the languages accepted by nonuniform additive circuits of polynomial size and polylogarithmic depth are those accepted by uniform additive circuits of polynomial size and polylogarithmic depth with advice. Moreover, we prove that binary languages accepted by real uniform circuits of polynomial size and polylogarithmic depth, when the test nodes in the circuit are equality test, are the languages belonging to NC; when the test nodes are inequality test, the class obtained is NC/Poly. We also prove that the class defined by family of algebraic circuits with polynomial size and polylogarithmic depth is strictly contained in the class defined by real additive Turing machines working in polynomial time.

We study the complexity of computing Boolean functions using AND, OR and NOT gates. We show that a circuit of depth d with S gates can be made to output a constant by setting O(S1− ) (where (d) = 4−d) of its input values. This implies a superlinear size lower bound for a large class of functions. Using this, we obtain a function computable by a uniform family of constant depth polynomial size circuits that cannot be computed by constant depth circuits of linear size. We give circuit constructions that show that the bound O(S1− ) is near optimal. We also study the complexity of computing threshold functions. The function T r has the value 1 iff at least r of its inputs have the value 1. We show that a circuit computing T r has at least Ω(r (logn)/ log r) gates, for r ≤ n, improving previous bounds. We also show a trade-off between the number of gates and the number of wires in a threshold circuit, namely, a circuit with G (< n/2) gates and W wires computing T r satisfies W ≥ Ω(nr(logn)/(log(G/ logn))), showing that it is not possible to simultaneously optimize the number of gates and wires in a threshold circuit. Our bounds for threshold functions are based on a combinatorial lemma of independent interest.

We continue the program of proving circuit lower bounds via circuit satisfiability algorithms. So far, this program has yielded several concrete results, proving that functions in mathsf {Quasi}text {-}mathsf {NP} = mathsf {NTIME}[n^{(log n)^{O(1)}}] and other complexity classes do not have small circuits (in the worst case and/or on average) from various circuit classes mathcal { C}, by showing that mathcal { C} admits non-trivial satisfiability and/or # SAT algorithms which beat exhaustive search by a minor amount. In this paper, we present a new strong lower bound consequence of having a non-trivial # SAT algorithm for a circuit class {mathcal C}. Say that a symmetric Boolean function f(x1,…,xn) is sparse if it outputs 1 on O(1) values of {sum }_{i} x_{i}. We show that for every sparse f, and for all “typical” mathcal { C}, faster # SAT algorithms for mathcal { C} circuits imply lower bounds against the circuit class f circ mathcal { C}, which may be stronger than mathcal { C} itself. In particular: # SAT algorithms for nk-size mathcal { C}-circuits running in 2n/nk time (for all k) imply NEXP does not have (f circ mathcal { C})-circuits of polynomial size.# SAT algorithms for 2^{n^{{varepsilon }}}-size mathcal { C}-circuits running in 2^{n-n^{{varepsilon }}} time (for some ε > 0) imply Quasi-NP does not have (f circ mathcal { C})-circuits of polynomial size.Applying # SAT algorithms from the literature, one immediate corollary of our results is that Quasi-NP does not have EMAJ ∘ ACC0 ∘ THR circuits of polynomial size, where EMAJ is the “exact majority” function, improving previous lower bounds against ACC0 [Williams JACM’14] and ACC0 ∘THR [Williams STOC’14], [Murray-Williams STOC’18]. This is the first nontrivial lower bound against such a circuit class.

Optimal Depth, Very Small Size Circuits for Symmetrical Functions in AC0

One-way functions and the isomorphism conjecture

It has long been known that cryptographic schemes offering provably unbreakable security exist, namely the One Time Pad (OTP). The OTP, however, comes at the cost of a very long secret key - as long as the plain-text itself. In this paper we propose an encryption scheme which we (boldly) claim offers the same level of security as the OTP, while allowing for much shorter keys, of size polylogarithmic in the computing power available to the adversary. The Scheme requires a large sequence of truly random words, of length polynomial in the both plain-text size and the logarithm of the computing power the adversary has. We claim that it ensures such an attacker cannot discern the cipher output from random data, except with small probability. We also show how it can be adapted to allow for several plain-texts to be encrypted in the same cipher output, with almost independent keys. Also, we describe how it can be used in lieu of a One Way Function.

Comparator Circuits over Finite Bounded Posets

This paper presents the following results on sets that are complete for NP. If there is a problem in NP that requires $2^{n^{\Omega(1)}}$ time at almost all lengths, then every many-one NP-complete set is complete under length-increasing reductions that are computed by polynomial-size circuits. If there is a problem in co-NP that cannot be solved by polynomial-size nondeterministic circuits, then every many-one NP-complete set is complete under length-increasing reductions that are computed by polynomial-size circuits. If there exist a one-way permutation that is secure against subexponential-size circuits and there is a hard tally language in NP∩co-NP, then there is a Turing complete language for NP that is not many-one complete. Our first two results use worst-case hardness hypotheses whereas earlier work that showed similar results relied on average-case or almost-everywhere hardness assumptions. The use of average-case and worst-case hypotheses in the last result is unique as previous results obtaining the same consequence relied on almost-everywhere hardness results.

Hardness against nondeterministic circuits is known to suffice for derandomizing Arthur-Merlin games. We show a result in the other direction - that hardness against nondeterministic circuits is *necessary* for derandomizing Arthur-Merlin games. In fact, we obtain an equivalence for a mild notion of derandomization: Arthur-Merlin games can be simulated in Sigma_2-SUBEXP (the sub exponential version of Sigma_2-P) with sub polynomial advice on infinitely many input lengths if and only if Sigma_2-E} (the linear-exponential version of Sigma_2-P) requires nondeterministic circuits of super polynomial size on infinitely many input lengths. Our equivalence result represents a full analogue of a similar result by Impagliazzo et al. in the deterministic setting: Randomized polynomial-time decision procedures can be simulated in NSUBEXP (the sub exponential version of NP) with sub polynomial advice on infinitely many input lengths if and only if NE (the linear-exponential version of NP) requires deterministic circuits of super polynomial size on infinitely many input lengths. A key ingredient in our proofs is improved Karp-Lipton style collapse results for nondeterministic circuits. The following are two instantiations that may be of independent interest: Assuming that Arthur-Merlin games can be derandomized in Sigma_2-P, we show that (i) PSPACE in NP/poly implies PSPACE in Sigma_2-P, and (ii) coNP in NP/poly implies PH in P^\Sigma_2-P.

We obtain the first true size-space trade-offs for the cutting planes proof system, where the upper bounds hold for size and total space for derivations with constantsize coefficients, and the lower bounds apply to length and formula space (i.e., number of inequalities in memory) even for derivations with exponentially large coefficients. These are also the first trade-offs to hold uniformly for resolution, polynomial calculus and cutting planes, thus capturing the main methods of reasoning used in current state-of-the-art SAT solvers. We prove our results by a reduction to communication lower bounds in a round-efficient version of the real communication model of [Kraj´iˇcek ’98], drawing on and extending techniques in [Raz and McKenzie ’99] and [G¨o¨os et al. ’15]. The communication lower bounds are in turn established by a reduction to trade-offs between cost and number of rounds in the game of [Dymond and Tompa ’85] played on directed acyclic graphs. As a by-product of the techniques developed to show these proof complexity trade-off results, we also obtain an exponential separation between monotone-ACi1 and monotone-ACi, improving exponentially over the superpolynomial separation in [Raz and McKenzie ’99]. That is, we give an explicit Boolean function that can be computed by monotone Boolean circuits of depth logi n and polynomial size, but for which circuits of depth O(logi1 n) require exponential size.

In this paper, we are concerned with the exponential complexity of the Circuit Satisfiability (CktSat) problem and more generally with the exponential complexity of NP-complete problems. Over the past 15 years or so, researchers have obtained a number of exponential-time algorithms with improved running times for exactly solving a variety of NP-complete problems. The improvements are typically in the form of better exponents compared to exhaustive search. Our goal is to develop techniques to prove specific lower bounds on the exponents under plausible complexity assumptions. We consider natural, though restricted, algorithmic paradigms and prove upper bounds on the success probability. Our approach has the advantage of clarifying the relative power of various algorithmic paradigms. Our main technique is a success probability amplification technique, called the Exponential Amplification Lemma, which shows that for any f(n,m)-size bounded probabilistic circuit family A that decides CktSat with success probability at least 2-α n for α 2-α n.In contrast, the standard method for boosting success probability by repeated trials will improve it to (1-(1-2-α n)t) (approx t2-α n for t=O(2α n)) using circuits of size about tf(n,m).Using this lemma, we derive tight bounds on the exponent of the success probability for deciding the CktSat problem in a variety of probabilistic computational models under complexity assumptions. For example, we show that the success probability cannot be better than 2-n+o(n) for deciding CktSat by probabilistic polynomial size circuits unless CktSat (thereby all of NP) for polynomial size instances can be decided by 2nμ size deterministic circuits for some μ

We study whether lower bounds against constant-depth algebraic circuits computing the Permanent over finite fields (Limaye-Srinivasan-Tavenas, J. ACM 2025; Forbes, CCC 2024) are hard to prove in certain proof systems. We focus on a DNF formula that expresses that such lower bounds are hard for constant-depth algebraic proofs. Using an adaptation of the diagonalization framework of Santhanam and Tzameret (SIAM J. Comput. 2025), we show unconditionally that this family of DNF formulas does not admit polynomial-size propositional AC0[p]-Frege proofs infinitely often. This rules out the possibility that the DNF family is easy, and establishes that its status is either that of a hard tautology for AC0[p]-Frege or else unprovable (not a tautology). While it remains open whether the DNFs in question are tautologies, we provide evidence in this direction. In particular, under the plausible assumption that certain weak properties of multilinear algebra, specifically those involving tensor rank, do not admit short constant-depth algebraic proofs, the DNFs are tautologies. We also observe that several weaker variants of the DNF formula are provably tautologies, and we show that the question of whether the DNFs are tautologies connects to conjectures of Razborov (ICALP 1996) and Krajicek (J. Symb. Log. 2004). Our result has two additional features. (i) Existential depth amplification: the DNF formula is parameterised by a constant depth d bounding the depth of the algebraic proofs. We show that there exists some fixed depth d such that if there are no small depth-d algebraic proofs of certain circuit lower bounds for the Permanent, then there are no such small algebraic proofs in any constant depth. (ii) Necessity: we show that our result is a necessary step towards establishing lower bounds against constant-depth algebraic proofs, and more generally against any sufficiently strong proof system.

We study the circuit complexity of generating at random a word of length n from a given language under uniform distribution. We prove that, for every language accepted in polynomial time by 1-NAuxPDA of polynomially bounded ambiguity, the problem is solvable by a logspace-uniform family of probabilistic boolean circuits of polynomial size and O(log2 n) depth. Using a suitable notion of reducibility (similar to the NC1-reducibility), we also show the relationship between random generation problems for regular and context-free languages and classical computational complexity classes such as DIV, L and DET.

Threshold circuits of bounded depth